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Abstract 

The virtualization and softwarization of modern computer networks enables the dehnition and fast 
deployment of novel network services called service chains: sequences of virtualized network functions 
(e.g., firewalls, caches, traffic optimizers) through which traffic is routed between source and destination. 
This paper attends to the problem of admitting and embedding a maximum number of service chains, 
i.e., a maximum number of source-destination pairs which are routed via a sequence of £ to-be-allocated, 
capacitated network functions. We consider an Online variant of this maximum Service Chain Embedding 
Problem, short OSCEP, where requests arrive over time, in a worst-case manner. Our main contribution 
is a deterministic 0(log£)-competitive online algorithm, under the assumption that capacities are at 
least logarithmic in £. We show that this is asymptotically optimal within the class of deterministic and 
randomized online algorithms. We also explore lower bounds for offline approximation algorithms, and 
prove that the offline problem is APX-hard for unit capacities and small £ > 3, and even Poly-APX-hard 
in general, when there is no bound on £. These approximation lower bounds may be of independent 
interest, as they also extend to other problems such as Virtual Circuit Routing. Finally, we present an 
exact algorithm based on 0-1 programming, implying that the general offline SCEP is in NP and by the 
above hardness results it is NP-complete for constant £. 


1 Introduction 

Today’s computer networks provide a rich set of in-network functions, including access control, firewall, in¬ 
trusion detection, network address translation, traffic shaping and optimization, caching, among many more. 
While such functionality is traditionally implemented in hardware middleboxes, computer networks become 
more and more virtualized [TJ[35]: Network Function Virtualization (NFV) enables a flexible instantiation 
of network functions on network nodes, e.g., running in a virtual machine on a commodity x86 server. 

Modern computer networks also offer new flexibilities in terms of how traffic can be routed through such 
network functions. In particular, using Software-Defined Networking (SDN) [16] technology, trafhc can be 
steered along arbitrary routes, i.e., along routes which depend on the application m, and which are not 
necessarily shortest paths or destination-based, or not even loop-free pT] . 

These trends enable the realization of interesting new in-network communication services called service 
chains jS] [T8| [23] : sequences of network functions which are allocated and stitched together in a flexible 
manner. For example, a service chain Ci could define that the traffic originating at source Si is first steered 
through an intrusion detection system for security (1®* network function), next through a traffic optimizer 
(2"'^ network function), and only then is routed towards the destination ti. Such advanced network ser¬ 
vices open an interesting new market for Internet Service Providers, which can become “miniature cloud 
providers” |24j specialized for in-network processing. 
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1.1 Paper Scope 

In this paper, we study the problem of how to optimally admit and embed service chain requests. Given 
a redundant distribution of network functions and a sequence a = (cti, a 2 , • ■ •, Ufe), where each ai = (s^, t^) 
for i G defines a source-destination pair {si,ti) which needs to be routed via a sequence of network 

function instances, we ask: Which requests ai to admit and where to allocate their service chains Cil The 
service chain embedding should respect capacity constraints as well as constraints on the length (or stretch) 
of the route from Si to ti via its service chain c^. 

Our objective is to maximize the number of admitted requests. We are particularly interested in the 
Online Service Chain Embedding Problem (OSCEP), where a is only revealed over time. We assume that a 
request cannot be delayed and once admitted, cannot be preempted again. Sometimes, we are also interested 
in the general (offline) problem, henceforth denoted by SCEP. 

1.2 Our Contribution 

We formulate the online and offline problems OSCEP and SCEP, and make the following contributions: 

1. We present a deterministic online algorithm ACE[^ which, given that node capacities are at least 
logarithmic, achieves a competitive ratio 0{\og£) for OSCEP. This result is practically interesting, as 
the number of to be traversed network functions £ is likely to be small in practice. To the best of our 
knowledge, so far, only heuristic and offline approaches to solve the service chain embedding problem 
have been considered [51II71113]. 

2. We establish a connection to virtual circuit routing and prove that ACE is asymptotically optimal in 
the class of both deterministic and randomized online algorithms. Moreover, we initiate the study of 
lower bounds for the offline version of our problem, and show that no good approximation algorithms 
exist, unless P = NP: for unit capacities and already small £, the offline problem SCEP is APX-hard. 
Eor arbitrary £, the problem can even become Poly-APX-hard. These results also apply to the offline 
version of classic online call control problems, which to the best of our knowledge have not been studied 
before. 

3. We present a 0-1 program for SCEP, which also shows that SCEP is in NP for constant £ and, taking into 
account our hardness result, that SCEP is NP-complete for constant £. More precisely, if the number 
of all possible chains that can be constructed over the network function instances is polynomial in 
the network size n then the number of variables in the 0-1 program is also polynomial, and thus the 
problem is in NP. If mi is the number of instances of network function fi in the network, i = !,...,£, 
and m = maxi{mi}, then the size of the 0-1 program is polynomial for = poly(n). This always 
holds for constant £. When m is constant, then it holds for £ = O(logn). 

1.3 Outline 

This paper is organized as follows. Section introduces our model and puts the model into perspective 
with respect to classic online optimization problems. We present the 0-1 program in Section the section 
also serves as a formal model for our problem. Section presents and analyzes the 0(log^)-approximation 
algorithm, and Section presents our lower bound. We summarize our results and conclude our work in 
Section [6l 

2 Model 

We are given an undirected network G = {V,E) with n = \V\ nodes and m = \E\ edges. On this graph, we 
need to route a sequence of requests a = (cti, a 2 , ■ ■ ■ ,ak)'- ai for any i represents a node pair ai = {si,ti) S 

^Admission control and Chain Embedding. 
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V X V. Each pair m needs to be routed (from Si to ti) via a sequence of £ network functions (Ei,... jF^). 
For each network function type Fi, there exist multiple instantiations ... in the network. (We will 

omit the superscript if it is irrelevant or clear in the context.) Each of these instances can be applied to 
along the route from Si to ti. However, in order to minimize the detour via these functions and in order to 
keep the route from Si to ti short, a “nearby instance” should be chosen, for each i. A service chain 
instance for (s^, ti) is denoted by Ci = ■ ■ ■, for some function instances j G [1, £]. 

For ease of presentation, we will initially assume that requests ai are of infinite duration. We will later 
show how to generalize our results to scenarios where requests can have arbitrary and unknown durations. 


O-<|lP\0 



bo-o 


Figure 1: Illustration of the model: The communication from si to ti and from S 2 to t 2 needs to be routed 
via a service chain {Fi, F 2 ). In this example, function Fi is instantiated once, and function F 2 is instantiated 
twice. Resources for (si,ti) are allocated only at the second instance of F 2 (the upper one). 


Concretely, in order to satisfy a request ai = {si,ti), a route of the following form must be computed: 


1. The route must start at Si, traverse a sequence of network functions ifi^^\f 2 ^^\ ■ ■ ■, and end 

(x ) 

at ti. Here, /j , j G [!,£] is an instance of the network function of type Fj. 

2. The route must not violate capacity constraints on any node v gV . Nodes v G V are capacitated and 
resources need to be allocated for each network function which is used for any [si,ti) pair. Multiple 
network functions may be available on the same physical machine, and only consume resources once 
they are used in certain service chains. The capacity k(v) of each node v G V hence defines the 
maximum number of requests ai for which v can apply its network functions. However, node v can 
always simply serve as a regular forwarding node for other requests, without applying the function. 


3. The route should be of (hop) length at most r (or have a bounded stretch, see Section 4.21. 


Otherwise, a request ai must be rejected. For ease of notation, in the following, we will sometimes assume 
that for a rejected request Ci — 0. Also note that the resulting route may not form a simple path, but 
more generally describes a walk: it may contain forwarding loops (e.g., visit a network function and come 
back). 

Our objective is to maximize the number of satisfied requests ai, resp. to embed a maximum number of 
service chains. We are mainly interested in the online variant of the problem, where a is revealed over time. 
More precisely, and as usual in the realm of online algorithms and competitive analysis, we seek to devise 
an online algorithm which minimizes the so-called competitive ratio: Let ON((7) denote the cost of a given 
online algorithm for a and let OFF(cr) denote the cost of an optimal offline algorithm. The competitive 
ratio p is defined as the worst ratio (over all possible a) of the cost of ON compared to OFF. Formally, 
p = maxcr ON(cr)/OFF(cr). 

Note that solving this optimization problem consists of two subtasks: 
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1. Admission control: Which requests ai to admit, and which to reject? 

2. Assignment and routing: We need to assign di = {si,ti) pairs to a sequence of network functions and 
route the flow through them accordingly. 

See Figure for an illustration of our model. 

2.1 Putting the Model into Perspective 

From an algorithmic perspective, the models closest to ours occur in the context of online call admission 
respectively virtual circuit routing. There, the fundamental problem is to decide, in an online manner, which 
“calls” resp. “virtual circuits” or entire networks, to admit and how to route them, in a link-capacitated 
graph. HII1 [ini [20] 

Instead of routes, in our model, service functions have to be allocated and connected to form service 
chains. In particular, in our model, nodes have a limited capacity and can only serve as network functions 
for a bounded number of source-destination pairs. The actual routes taken in the network play a secondary 
role, and may even contain loops. In particular, our model supports the specification of explicit constraints 
on the length of a route, but also on the stretch: the factor by which the length of a route from a source to 
a destination can be increased due to the need to visit certain network functions. 

Nevertheless, as this paper shows, several techniques from classic literature on online call control can 
be applied to our model. At the same time, to the best of our knowledge, some of our results also provide 
new insights into the classic variants of call admission control. For example, our lower bounds on the 
approximation ratio also translate to classic problems, which so far have mainly been studied from an online 
perspective. 


3 Optimal 0-1 Program and NP-Completeness 

SCEP can be formulated as a 0-1 integer linear program. This together with our hardness results also proves 
NP-completeness for constant £: 0-1 integer linear programming is one of Karp’s NP-complete problems [Ill- 

Let cr = {di = {si,ti) : Si,ti £ V} be the set of requests, and let C be the set of possible chains over k 
nodes, respecting route length constraints. We refer by c G C to a potential chain. For all potential chains 
c £ C, let Sc be the set of connection requests in d that can be routed through c on a path of length at most 
r, i.e., for c = (-Ci,...,-u^), let Sc = {di = {si,U) £ d : d{si,vi) + I]i= 2 + divk,ti) < r}, where 
d{u, v) denotes the length of the shortest path between nodes m, n G I? in the network G. The shortest paths 
between nodes can be computed in a preprocessing step. 

For all connection requests di £ cr, we introduce the binary variable Xi £ {0,1}. The variable Xi = 1 
indicates that the request i is admitted in the solution. For all potential network function chains c £ C, we 
introduce the binary variable Xc £ {0,1}. The variable Xc = 1 indicates that C is selected in the solution. 
For all c G C and di £ d, we introduce the binary variable Xc,i £ (0,1}. The variable Xc,i indicates that 
the request di = {si,ti) £ d is routed through the nodes of c, such that the length of the walk from Si to U 
through c has length at most r. 
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maximize Xi 


(1) 

<7i^a 



s.t. X, -y^xcd = 0 

y ai G a 

(2) 

ceC 



^ ^ - 0 

y ai G a 

( 3 ) 

c^C:(Ti^Sa 




y V G V,y c G C : V G c 

( 4 ) 


y V gv 

( 5 ) 

cGC:vGc 



Xc,i < k{v) ■ Xy 

y V gv 

(6) 

(TiGcr cGC:vGc 



Xq i C {0,1} 

y V G V,y c G C,y ai G a 

( 7 ) 


The objective function Q asks for admitting a request set of maximum cardinality. The Constraints ([^ 
enforce that each admitted request ai G a is assigned to exactly one chain c G C, and rejected requests are 
not assigned to any chain, i.e., for each ai with Xi = 1, there is exactly one chain c with Xc,i = 1, and for 
each i with Xi = 0, we have Xc^i = 0 for all c. Constraints ([^ state that each ai G a can only be assigned to 
a chain c G C with Ui G Sc- By definition of Sc, the nodes Si and U can be routed through c by a path of 
length at most r. Constraints Q ensure that if a node u S V is contained in a selected chain c (i.e., Xc = 1), 
then Xy = i- Constraints (§ enforce that if a node u G V is not contained in any selected chain, i.e., Xc = 0 
for all chains c with v G c, then Xy = 0. Therefore, Constraints and together imply that = 1 iff 
V is contained in a selected chain c. Constraints Q describe that the number of requests routed through 
a node u of a selected chain is limited by the capacity k{v) of v. Furthermore, ([^ ensures that if v is not 
contained in any selected chain (i.e., Xy = 0) then no request q is assigned to any chain c with v G c. 

The solution of this 0-1 program defines a maximum cardinality set of admitted requests a admit = : 

Xi = 1}, and an assignment of each request ai G a admit to a chain c G C. Each request ai G a admit is 
assigned to a chain C G C iff Xc,i = 1. This assignment guarantees that (f) the request ai = {si,ti) can be 
routed through c on a path of length at most r, {ii) the number of pairs routed through any node v G V of a, 
selected chain is limited by the capacity k(v) of v, and (Hi) none of the requests ai G aadmit are assigned to 
a non selected chain. Furthermore, it is guaranteed that rejected requests ai G a \ aadmit are not assigned 
to any chain. 


4 Competitive Online Algorithm 

We present an online algorithm ACE for OSCEP. ACE admits and embeds at least a r2(log.^)-fraction of 
the number of requests embedded by an optimal offline algorithm OFF. 

Let us first introduce some notation. Let Aj be the set of indices of the requests admitted by ACE just 
before considering the jth request aj. The index set of all admitted requests after processing all k requests 
in a, will be denoted by Ak+i resp. A. 

The relative load A„(j) at node v before processing the jth request, is defined by the number of service 
chains Ci in which v participates, divided by v’s capacity: 

, = n°- - 

n[v) 

We seek to ensure the invariant that capacity constraints are enforced at each node, i.e., 'ivGV^j<k-\-l: 
A„(j) < 1. 

We define fj, = 2£ + 2, and in the following, will assume that 

min{K(z;)} > log^ (8) 
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4.1 Algorithm 


The key idea of ACE is to assign to each node, a cost which is exponential in the relative node load. More 
precisely, with each node we associate a cost Wy{j) just before processing the jth request aj: 

Wv{j) = - 1 ). 

Our online algorithm ACE simply proceeds as follows: 

• When request a-j arrives, ACE checks if there exists a chain cj, (Jj G Sc^, satisfying the following 
condition: 


E 

vGCj 


Wyjj) 

k{v) 


< i 


(9) 


• If such a chain Cj exists, then admit aj and assign it to Cj. Otherwise, reject aj. 

In order to ensure that chains selected for Condition M also fulfill the constraint on the maximal route 
length, ACE simply uses preprocessing. We maintain at each node its relative load. When a new request 
arrives ACE has to test the costs of at most O(n^) chains, and the cost can be computed in 0(£) time per 
chain. The overall runtime of ACE per step is hence bounded by 0(£ ■ n^), which is polynomial for constant 
£. 


4.2 Analysis 


The analysis of the competitive ratio achieved by ACE exploits a connection to Virtual Circuit Routing [20] 
and unfolds in three lemmata. First, in Lemma [4.1| we prove that the set A of requests admitted by ACE 
are feasible and respect capacity constraints. Second, in Lemma |4.2[ we show that at any moment in time, 
the sum of node costs is within a factor 0(£ ■ log/i) of the number of requests already admitted by ACE. 
Third, in Lemma |4.3[ we prove that the number of requests admitted by the optimal offline algorithm OFF 
but rejected by the online algorithm, is bounded by the sum of node costs after processing all requests. 

Let W be the sum of the node costs after ACE processed all k request, let Aoff be the indices of 
the requests admitted by OFF, and let A* = Aqff \ A. Then, from Lemma 4.2 we will obtain a bound 


|A| > Wl(2£ ■ log/r), and from Lemma 4.3 that |A*| < VF/f'. 

Thus, even by conservatively ignoring all the requests which ACE might have admitted which OFF did 
not, we obtain that the competitive ratio of ACE is at most Oi\og£). 

Let us now have a closer look at the first helper lemma. 


Lemma 4.1 For all nodes v G V: 

E ^ 

jGA-.vGcj 

Proof: Let aj be the first request admitted by ACE, such that the relative load Xy{j + 1) at some node 
V G Cj exceeds 1. By definition of the relative load we have A„(j) > 1 — 1/k{v). 

By the assumption that log/r < k{v), we get 

_ 1 > ^i-i/iogM - 1 = ^/2 - 1 = A 

Therefore, by Condition ([^, the request aj could not be assigned to Cj. We established a contradiction. □ 
Next we show that the sum of node costs is within an 0(£ • log fi) factor of the number of already admitted 
requests. 

Lemma 4.2 Let A be the set of indices of requests admitted by the online algorithm. Let k be the index of 
the last request. Then 

{2£\ogfi)\A\ > '^Wy{k + 1). 
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Proof: We show the claim by induction on k. For fc = 0, both sides of the inequality are zero, thus the 
claim is trivially true. Rejected requests do not change either side of the inequality. Thus, it is enough to 
show that, for each j < A:, if we admit aj, we get: 


+ 1) - Wy{j)) < 2£log^. 


V 


Consider a node v G Cj. Then by definition of the costs: 

wAj + 1 ) - w,ij) = 

= - 1 )) 

= _ 1)) 

By Assumption Q, 1 < K{n)/log^. Since 2“ — 1 < x, for 0 < a; < 1, it follows: 

WvU + ^)-Wv{j) < 

= log fl{Wy{j) / k{v) + 1). 

Summing up over all the nodes and using the fact that the request aj was admitted and chain Cj was assigned, 
and that the number of nodes |cjj in Cj is i, we get: 


+ 1) - Wy{j)) < logfi{£ + \cj\) = 2 e\og^l. 


V 


This proves the claim. 


□ 


We finally prove that £ times the number of requests rejected by ACE but admitted by the optimal 
offline algorithm OFF is bounded by the sum of node costs after processing all requests. 


Lemma 4.3 Let Aqff A/ie set of indices of the requests that were admitted hy the optimal offline algo¬ 
rithm, and let A* = Aqff \ A be the set of indices of requests admitted hy Aqff but rejected by the online 
algorithm. Then: 


|A*| • i < ^ Wv{k + 1). 


V 


Proof: For j G A*, let c* be the chain assigned to request aj by the optimal offline algorithm. By the fact 
that aj was rejected by the online algorithm, we have: 



Since the costs Wy{j) are monotonically increasing in j, we have 



Summing over all j G A*, we get 



< ^ Wy{k + 1 ). 


V 


The last inequality follows from the fact that capacity constraints need to be met at any time. 


□ 
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Theorem 4.4 ACE is O{log i)-competitive. 


Proof: By Lemma |4.1[ capacity constraints are never violated. It remains to show that the number of 
requests admitted by the online algorithm is at least 1/(2 log 2/r) times the number of requests admitted by 
the optimal offline algorithm. The number of requests admitted by the optimal offline algorithm |Aoff| can 
be bounded by the number of requests admitted by the online algorithm |A| plus the number of requests in 
A* = Aoff \ A. Therefore, 

|Aoff| < |A| + |A*|. 

By Lemma [T3| this is bounded by 

|Aoff| < |A| + - ^ Wv{k + 1). 


By Lemma 4.2 this is bounded by 


|Aoff| < |A| + 2 • (log/r) • |A| 
= (l + 21og/i)|A| 


Therefore, the number of requests admitted by the optimal offline algorithm is at most (1 + 21og/i) times 
the number of requests admitted by ACE. □ 

Remarks. We conclude with some remarks. First, we note that our approach leaves us with many 
flexibilities in terms of constraining the routes through the network functions. For instance, we can support 
maximal path length requirements: the maximal length of the route from s to t via the network functions. 
A natural alternative model is to define a limit on the stretch: the factor by which the “detour” via the 
network functions can be longer than the shortest path from s to t. Moreover, so far, we focused on a model 
where requests, once admitted, stay forever. Our approach can also be used to support service chain requests 
of bounded or even unknown duration. In particular, by redefining pL to take into account the duration of 
a request, we can for example apply the technique from |20| to obtain competitive ratios for more general 
models. 


5 Optimality and Approximation 

It turns out that ACE is asymptotically optimal within the class of online algorithms (Theorem |5.I[ ). This 
section also initiates the study of lower bounds for (offline) approximation algorithms, and shows that for 
low capacities, the problem is APX-hard even for short chains (Theorem |5.2[ ), and even Poly-APX-hard in 
general, that is, it is as hard as any problem that can be approximated to a polynomial factor in polynomial 
time (Theorem |5.3[ ). 

Theorem 5.1 Any deterministic or randomized online algorithm for OSCEP must have a competitive ratio 
of at least n(log^). 

Proof: We can adapt the proof of Lemma 4.1 in for our model. We consider a capacity of k > log£, 
and we divide the requests in a into logi + I phases. We assume that n > 2£^, and only focus on a subset 
L oi i = \L\ nodes which are connected as a chain {vi,... ,ve) and at which the different service chains will 
overlap. In phase 0, a group of k service chains are requested, all of which need to be embedded across 
the nodes L = {ui,... ,ve}. In phases i > I, 2® groups of k identical requests will need to share subsets 
of L of size ^/2®, that is, the jth group, 0 < j < 2®, consists of k requests to be embedded across nodes 
^ 0 +i)^/ 2 ’]- See Figureplfor an illustration. 

Let Xi denote the number ofmequests an online algorithm ON admits in phase i. Each request accepted 
in phase i will occupy £/2® units of capacities of nodes in L. Overall, the nodes in L have a capacity of i ■ k, 
so it must hold that 

log-^ £ 

• Xi < i ■ K. 

2 ® “ 

i=0 
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- - ^ Phase 2 

cxx>ocxx>o 
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Ml M, 

Figure 2: Illustration of lower bound construction: The adversary issues service chain requests in 1 + log-^ 
phases, where each phase i consists of 2® groups of k > log^ requests. In phase 0 the adversary issues requests 
that can be assigned to L = (wi, As intersections of chains in phase i with L are becoming shorter 

over time, the online algorithm needs to decide whether to admit service service chain requests in phases, 
where each phase consists of groups with k chains. As chains are becoming shorter over time, the online 
algorithm faces the problem whether to admit service chains early (and hence block precious resources), or 
late (in which case the adversary stops issuing new requests). 

Now, for 0 < j < log^, define Sj = ^ ■ J2i= 
nodes of L after phase j. Then: 

log^ 

j=o 


Hence there must exist a j such that Sj < 2^K| log Then after phase j, the number of requests admitted 
by the online algorithm ON is 


, Xi. Sj is a lower bound on the occupied capacity on the 


log i 3 

J=0 2 = 0 

logf logf 
2=0 j—i 

i=0 

= 21k. 




Xi = < ^2£k/ log£ = 2 • 2^k/ log£. 

i=0 

The optimal offline algorithm OFF can reject all requests except for those of phase j. The number of 
requests in phase j, and thus, the number of requests admitted by OFF is 2^ k. □ 

In the following, we also show that for networks with low capacities, it is not even possible to approximate 
the offline version of the Service Chain Embedding Problem, SCEP in polynomial time. These lower bounds 
on the approximation ratio naturally also constitute lower bounds on the competitive ratio which can be 
achieved for OSCEP by any online algorithm. 

In particular, we first show that already for short chains in scenarios with unit capacities, SCEP cannot 
be approximated well. 

Theorem 5.2 In scenarios where service chains have length £ > 3 and where capacities are k(v) = 1, for 
all V, the offline problem is APX-hard. 
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Proof: The proof follows from an approximation-preserving reduction from Maximum k-Set Packing 

Problem (KSP). The Maximum Set Packing (SP) is one of Karp’s 21 NP-complete problems, where for a 
given collection C of finite sets a collection of disjoint sets C" C C of maximum cardinality has to be found. 
The KSP is the variation of the SP in which the cardinality of all sets in C are bounded from above by any 
constant fc > 3, is APX-complete HU. We refer to such sets as fc-sets. 

KSP can be reduced to our problem as follows. Let U be the universe and C be a collection of fc-sets 
of U in the KSP. W.l.o.g., we assume that each fc-set contains exactly fc elements, otherwise we can add 
disjoint auxiliary elements to the sets in order to obtain exactly fc elements in each set in C. For each u G U 
in the KSP instance we construct a node Vu in the SCEP instance. Furthermore, for each fc-set S in C, we 
construct a service chain cg, such that cg contains exactly the nodes {v^ ■ u G S}. Let C be the set of 
obtained service chains. For the set of requests a we require that \a\ > \C\ and that each request can be 
assigned to each service chain. Due to the unit capacity assumption, the set of admitted request must be 
assigned to mutually disjoint service chains. Thus, the maximum number of admitted requests is at most 
the maximum number of disjoint service chains. Since each request can be assigned to each service chain and 
|(t| > |C|, an optimal solution for the SCEP determines a maximum set of mutually disjoint service chains. 
This maximum set of disjoint service chains determines a maximum number of disjoint fc-sets, and thus, an 
optimal solution for the KSP. □ 

It turns out that in general, with unit capacities, SCEP cannot even be approximated within polyloga- 
rithmic factors. 

Theorem 5.3 In general scenarios where capacities are k{v) = 1 , for all nodes v, and the chain length 
£ > 3, the SCEP is. APX-hard and not approximable within P for some e > 0. Without a bound on the 
ehain length the SCEP with k{v) = 1, for all nodes v, is Poly-APX-hard. 

Proof: We reduce the Maximum Independent Set (MIS) problem with maximum degree I to the SCEP 
with capacity k{v) = 1, for all S K and chain length I. For graphs with bounded degree £> 3, the 
MIS is APX-complete m and cannot be approximated within P for some £ > 0 [U. By our reduction we 
obtain the APX-hardness and non-approximability within P for some £ > 0 for the SCEP. In general, for 
graphs without degree bound, the MIS is Poly-APX-complete [6], i.e. it is as hard as any problem that can 
be approximated to a polynomial factor. By our reduction we obtain that the SCEP without chain length 
bound is Poly-APX-hard. 

For an instance G = (V, E) of the MIS problem with maximum degree i, we construct an instance of the 
SCEP with capacity k = 1 and chain length £ as follows. For each node v G G, let c„ be the chain whose 
nodes correspond to the edges in G incident to v. If degQ('(;) < £ then we complete the chain with £ — degQ{v) 
unique auxiliary nodes, in order to have £ nodes in the chain. The chain set is C = {c„ : v G G}. For the 
set of requests a, we require that \a\ > \G\ and each request at G a can be assigned to each cG G. Assigning 
a CTi to a chain c G G fills the capacity of all nodes in c and the capacity of all chains c' G G that contain a 
common node with c. Therefore, no further request aj, j i, can be assigned to those chains. The chains 
having a common node with c^ correspond exactly the neighbors of v in G. Therefore, nodes u and v are 
independent in the MIS instance iff chains c^ and Cy do not have a common node in the SCEP instance. 
Since each request cTj can be assigned to each c G G and \a\ > |C|, a maximum number of admitted requests 
is determined by a maximum chain set C", such that for all c„, c„ G G', Cu and c„ do not contain a common 
node. Therefore, G' determines a maximum independent set in G. Consequently, an a-approximation for 
the SCEP would imply an a-approximation for the MIS problem. □ 


6 Summary and Conclusion 

Over the last decades, a large number of middleboxes have been deployed in computer networks, to increase 
security and application performance, as well as to offer new services in the form of static and dynamic 
in-network processing (see the services by Akamai, Google Global Cache, Netflix Open Connect). 

However, the increasing cost and inflexibility of hardware middleboxes (slow deployment, complex up¬ 
grades, lack of scalability), motivated the advent of Network Function Virtualization (NFV) [71 ITl IT^ fT5] . 
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which aims to run the functionality provided by middleboxes as software on commodity hardware. The 
transition to NFV is discussed within standardization groups such as ETSI, and we currently also witness 
first deployments, e.g., TeraStream [25]. 

The possibility to chain individual network functions to form more complex services has recently attracted 
much interest, both in academia [niiig, as well as in industry |18j . 

Our paper made a first step towards a better understanding of the algorithmic problem underlying the 
embedding of service chains. Our main contribution is a deterministic online algorithm ACE which achieves 
a competitive ratio of 0{\og£) for OSCEP, given that node capacities are at least f7(log£). This is interesting, 
as the number £ of to-be-chained network functions is likely to be a small constant in practice. We also show 
that ACE is asymptotically optimal, in the sense that no deterministic or randomized online algorithm can 
achieve a competitive ratio o{\og£). Moreover, we initiate the study of lower bounds for the offline version of 
our problem, and show that no good approximation algorithms exist, unless P — NP: the offline problem is 
APX-hard for unit capacities and service chains of length three. In general, the problem is even Poly-APX- 
hard under unit capacities. These results also apply to the offline version of classic Virtual Circuit Routing. 
Finally, this paper presented an exact algorithm based on 0-1 linear programming for solving the offline 
SCEP optimally, which implies that the offline SCEP is in NP, if the size of the 0-1 program is polynomial, 
which holds for constant £ - 0-1 programming is one of Karp’s 21 NP-complete problems El- 

We believe our paper opens several interesting directions for future research. Eor instance, it would be 
interesting to find a lower bound for the approximation ratio for the offline problem version where £ = 2. 
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